diff --git a/nixos/modules/services/networking/sing-box.nix b/nixos/modules/services/networking/sing-box.nix
index d32725f77147..a884bcd271ec 100644
--- a/nixos/modules/services/networking/sing-box.nix
+++ b/nixos/modules/services/networking/sing-box.nix
@@ -56,6 +56,7 @@ in
 
     systemd.services.sing-box = {
       preStart = ''
+        umask 0077
         mkdir -p /etc/sing-box
         ${utils.genJqSecretsReplacementSnippet cfg.settings "/etc/sing-box/config.json"}
       '';